LSU Research Bites: Breakthrough File Recovery System Rebuilds Lost Data From Damaged or Fragmented Devices
November 14, 2025
An unauthorized drone crashes, and its onboard storage devices are damaged beyond repair. No cybersecurity tools exist that can recover the fragmented data from such a device—until now.
When files are deleted or a storage device, such as when a criminal tries to delete incriminating evidence from a computer’s hard drive before throwing it in a dumpster, the data aren’t always truly gone.
Digital forensics experts often use “file carving” tools that sift through raw data left behind and look for file signatures (specific sequences of bytes) that mark the beginning and end of a file.
These tools can extract and reassemble the remaining data of detected files.
Because carving doesn’t care about complete files and doesn’t search by file name or location, it can reconstruct files that were hidden, renamed, or relocated on a device.
But existing carving tools have one major limitation. They can only recover raw data available in a single, continuous block. If the data are fragmented, truly deleted, or written over by new data, traditional carving fails.
There are no existing tools except for Scalpel3 that might be employed to attempt to recover the fragmentary data on the device, to determine its origin, and the nature of its operation.
Golden George Richard III, Professor of Computer Science and Engineering and Director of the LSU Cyber Center and Applied Cybersecurity Lab
This is a major limitation for cybersecurity experts who could answer many more questions about security incidents if they could reconstruct fragmented data.
Five years ago, Golden George Richard III, Professor of Computer Science and Engineering and Director of the LSU Cyber Center and Applied Cybersecurity Lab, decided to work on what others thought was impossible: a tool for recovering fragmented data.
After many failures and restarts, he has developed a carving framework named Scalpel3, designed explicitly to support both contiguous and fragmented file recovery at scale. Scalpel3 can rebuild files that have been scattered across a damaged drive.
Scalpel3 works like an expert, putting puzzle pieces together by using matching algorithms and aligning small overlapping pieces of data in a manner similar to how DNA sequencing works.
“There are no existing tools except for scalpel3 that might be employed to attempt to recover the fragmentary data on the device, to determine its origin, and the nature of its operation,” Richard said.
Scalpel3 could transform digital forensics, helping to solve cybercriminal investigations more quickly and accurately. It would improve national security and enable data recovery after natural disasters. On the flipside, it could help cybersecurity experts create more secure systems for truly erasing sensitive data, for example.
Richard’s lab is currently in the process of submitting several peer-reviewed research papers on this toolchain and hopes to make it publicly available in the near future.
Next Step
LSU's Scholarship First Agenda is helping achieve health, prosperity, and security for Louisiana and the world.